CVE-2022-49068

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: release correct delalloc amount in direct IO write path

Running generic/406 causes the following WARNING in btrfs_destroy_inode()

which tells there are outstanding extents left.

In btrfs_get_blocks_direct_write(), we reserve a temporary outstanding

extents with btrfs_delalloc_reserve_metadata() (or indirectly from

btrfs_delalloc_reserve_space(()). We then release the outstanding extents

with btrfs_delalloc_release_extents(). However, the "len" can be modified

in the COW case, which releases fewer outstanding extents than expected.

Fix it by calling btrfs_delalloc_release_extents() for the original length.

To reproduce the warning, the filesystem should be 1 GiB. It's

triggering a short-write, due to not being able to allocate a large

extent and instead allocating a smaller one.

WARNING: CPU: 0 PID: 757 at fs/btrfs/inode.c:8848 btrfs_destroy_inode+0x1e6/0x210 [btrfs]

Modules linked in: btrfs blake2b_ge

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References